Meatmeet Pro CVE-2025-65822

Requires physical possession of the Meatmeet Pro and a hardware connection to the ESP32 SoC's JTAG debug port, which the vendor shipped enabled in firmware 1.0.34.4 (CWE-1191). No authentication is required once connected (PR:N) and complexity is low (AC:L), but exploitation is strictly limited by the need for local physical access to the device (AV:P) - it is not remotely reachable over the network or Bluetooth. Recovery of the victim's Wi-Fi network additionally depends on the SSID/credentials being stored in the device's NVS partition, as the description states.

Signals are consistent and point to a genuine but low-urgency, physically-gated issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) confirms the attack requires physical access (AV:P) but is otherwise unauthenticated and low-complexity with full C/I/A impact once the attacker is at the device. This physical requirement is corroborated by the description, which centers on an attacker connecting to the JTAG port. EPSS is low at 0.21% (11th percentile), consistent with a physical-access bug that cannot be automated or sprayed across the internet. The vuln.today priority is 'this_month' (not act_now/emergency), and there is no CISA KEV listing, so there is no confirmed active exploitation. No SSVC decision breakdown (exploitation/automatable/technical-impact) was supplied. The two references are independent researcher write-ups describing the JTAG-enabled condition; they are PoC references, not verified working exploit code. Net: a real, confirmed hardware-exposure weakness worth remediating, but the physical-access barrier and low EPSS make it a routine-priority item, not a widespread remote threat.

An attacker who gains physical possession of a Meatmeet Pro thermometer connects to the exposed JTAG debug port on its ESP32 SoC and, because JTAG is left enabled, reflashes the device with malicious firmware that runs on boot. The low attack complexity means no special timing or configuration is needed once the device is in hand; a public PoC reference describing the enabled JTAG exists but is not verified as working exploit code. The tampered device then denies the owner normal functionality and, by reading the SSID/credentials stored in the NVS partition, can let the attacker rejoin the victim's Wi-Fi network.